Collected research

Cookies Lack Integrity: Real-World Implications

Xiaofeng Zheng, Jian Jiang, Jinjin Liang, Haixin Duan, Shuo Chen, Tao Wan and Nicholas Weaver · usenix.org

Cookies carry no indication of how they were set, so a temporary man-in-the-middle on any plain HTTP request, or a web attacker on a related domain, can plant cookies that the browser then sends on later HTTPS connections.

Record

Researcher

Xiaofeng Zheng, Jian Jiang, Jinjin Liang, Haixin Duan, Shuo Chen, Tao Wan and Nicholas Weaver

Published by

usenix.org

Topic

Identity

In the archive

• Collected in the 2015 research round

Tags

• cookie
• session-fixation
• injection
• https
• auth-bypass
• measurement-study
• mitigation
• owasp-a01-2021
• owasp-a02-2021
• owasp-a03-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Xiaofeng Zheng, Jian Jiang, Jinjin Liang, Haixin Duan, Shuo Chen, Tao Wan and Nicholas Weaver, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 19 August 2026.